@4da/mcp-server 6.0.2 → 6.2.0

package/dist/live/github-releases.js

@@ -0,0 +1,252 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Opt-in changelog fallback for `upgrade_impact`: GitHub releases, and a
+ * changelog FILE a PyPI project links from `project_urls` when that file is
+ * on GitHub (Decision 1, option B, approved 2026-10-11).
+ *
+ * Off by default. The default contract stays option A: only the package's own
+ * registry and OSV.dev are contacted. A user who wants release notes for the
+ * many packages whose archive ships no changelog (vite, zod, cobra, most Go
+ * modules) sets FOURDA_GITHUB_CHANGELOG=true; GitHub then learns the
+ * repository and the version range, nothing else. GITHUB_TOKEN, when set, is
+ * sent as a bearer token (5,000 requests an hour instead of 60).
+ *
+ * What is parsed is what the project itself published as release notes: the
+ * release body (Markdown), read by the same parser and classifier as an
+ * archive changelog, one section per release whose tag names a version of
+ * this package. A docs page (HTML) is never parsed. Rate limits are reported,
+ * not retried: the answer says when the limit resets and how to raise it.
+ */
+import { CHANGELOG_PARSER_VERSION, isChangelogName, parseChangelog } from "./changelog.js";
+import { ArchiveError, MAX_FILE_BYTES } from "./package-archive.js";
+export const GITHUB_CHANGELOG_ENV = "FOURDA_GITHUB_CHANGELOG";
+const CACHE_SOURCE = "upgrade-impact";
+/** A range whose target release is published: release notes rarely change after. */
+const FOUND_TTL = 24 * 3600;
+const MISS_TTL = 3600;
+const PER_PAGE = 100;
+const MAX_PAGES = 5;
+const GITHUB_TIMEOUT_MS = 15_000;
+const USER_AGENT = "4da-mcp-server (https://4da.ai; upgrade_impact)";
+/** True when the user opted in: FOURDA_GITHUB_CHANGELOG is 1 / true / yes / on. */
+export function githubChangelogEnabled(env = process.env) {
+    return /^(?:1|true|yes|on)$/i.test(String(env[GITHUB_CHANGELOG_ENV] ?? "").trim());
+}
+/** `owner/repo` of a GitHub URL (https, git+https, git@, shorthand), or null. */
+export function parseGithubRepo(url) {
+    if (!url)
+        return null;
+    const raw = url.trim();
+    const m = /^(?:github:)?([\w.-]+)\/([\w.-]+)$/.exec(raw) ??
+        /github\.com[/:]([\w.-]+)\/([\w.-]+?)(?:\.git)?(?:[/#?].*)?$/i.exec(raw);
+    if (!m)
+        return null;
+    const repo = m[2].replace(/\.git$/, "");
+    if (!repo || m[1] === "." || repo === "." || repo === "..")
+        return null;
+    return { owner: m[1], repo };
+}
+export class GithubRateLimitError extends Error {
+}
+function headers() {
+    const h = {
+        Accept: "application/vnd.github+json",
+        "X-GitHub-Api-Version": "2022-11-28",
+        "User-Agent": USER_AGENT,
+    };
+    const token = process.env.GITHUB_TOKEN?.trim();
+    if (token)
+        h.Authorization = `Bearer ${token}`;
+    return h;
+}
+/** A 403/429 that is a rate limit, with when it lifts. */
+function rateLimitMessage(res) {
+    if (res.status !== 403 && res.status !== 429)
+        return null;
+    const remaining = res.headers.get("x-ratelimit-remaining");
+    const retryAfter = res.headers.get("retry-after");
+    if (remaining !== "0" && !retryAfter && res.status !== 429)
+        return null;
+    const reset = Number(res.headers.get("x-ratelimit-reset"));
+    const when = Number.isFinite(reset) && reset > 0
+        ? `resets at ${new Date(reset * 1000).toISOString()}`
+        : retryAfter
+            ? `retry after ${retryAfter} s`
+            : "try again later";
+    const auth = process.env.GITHUB_TOKEN?.trim()
+        ? "GITHUB_TOKEN is set; its hourly limit is spent"
+        : "set GITHUB_TOKEN to raise the limit from 60 to 5,000 requests an hour";
+    return `GitHub API rate limit reached (${when}); ${auth}`;
+}
+const KNOWN_TAG_PREFIX = /^(?:v|version[-_]?|release[-_]?|rel[-_]?)?$/i;
+/**
+ * The version a release tag names for this package, or null when the tag is
+ * another package's (monorepos) or not a version. `tagPrefix` is a Go
+ * module's subdirectory (`service/s3`): its tags are `service/s3/v1.2.3`.
+ */
+export function versionFromTag(tag, pkg, tagPrefix) {
+    let rest = tag.trim();
+    if (tagPrefix) {
+        if (!rest.startsWith(`${tagPrefix}/`))
+            return null;
+        rest = rest.slice(tagPrefix.length + 1);
+    }
+    const m = /^(.*?)(\d+\.\d+(?:\.\d+)*(?:[-.+]?[0-9A-Za-z][0-9A-Za-z.+-]*)?)$/.exec(rest);
+    if (!m)
+        return null;
+    const prefix = m[1];
+    if (KNOWN_TAG_PREFIX.test(prefix))
+        return m[2];
+    // A monorepo tag: `pkg@1.2.3`, `pkg-v1.2.3`, `@scope/pkg@1.2.3`, `pkg/v1.2.3`.
+    const fold = (s) => s.toLowerCase().replace(/[^a-z0-9]+/g, "");
+    const bare = prefix.replace(/(?:[@/_-]v?|v)$/i, "");
+    const name = pkg.split("/").pop() ?? pkg;
+    return fold(bare) === fold(pkg) || fold(bare) === fold(name) ? m[2] : null;
+}
+/** Release-body lines that are bookkeeping, not changes. */
+const NOISE = /made their first contribution|^\W*full changelog\W|^\W*(?:new )?contributors?\W*$/i;
+/** One section per release that names a version of this package, entries parsed from its notes. */
+export function releasesToSections(releases, pkg, tagPrefix) {
+    const sections = [];
+    for (const r of releases) {
+        if (r.draft || typeof r.tag_name !== "string")
+            continue;
+        const version = versionFromTag(r.tag_name, pkg, tagPrefix);
+        if (!version)
+            continue;
+        const date = (r.published_at ?? r.created_at ?? "").slice(0, 10) || null;
+        // A synthetic heading makes the body one release; a body that repeats its own
+        // version heading opens the same version again, and those entries are kept too.
+        const parsed = parseChangelog(`# ${version}\n\n${(r.body ?? "").slice(0, MAX_FILE_BYTES)}`);
+        const entries = parsed
+            .filter((s, i) => i === 0 || s.version.replace(/^v/, "") === version.replace(/^v/, ""))
+            .flatMap((s) => s.entries)
+            .filter((e) => !NOISE.test(e.text) && !(e.under && /^\W*new contributors\W*$/i.test(e.under)));
+        sections.push({ version, date, entries });
+    }
+    return sections;
+}
+/**
+ * Release notes for `pkg` from `owner/repo`, newest first, paging until a
+ * release at or below `from` is seen (at most MAX_PAGES pages of 100).
+ */
+async function fetchReleases(net, repo, stop, pkg, tagPrefix) {
+    const out = [];
+    for (let page = 1; page <= MAX_PAGES; page++) {
+        const url = `https://api.github.com/repos/${encodeURIComponent(repo.owner)}/${encodeURIComponent(repo.repo)}/releases?per_page=${PER_PAGE}&page=${page}`;
+        const res = await net.fetch(url, { headers: headers() }, GITHUB_TIMEOUT_MS);
+        const limited = rateLimitMessage(res);
+        if (limited)
+            throw new GithubRateLimitError(limited);
+        if (res.status === 404)
+            throw new Error(`github.com/${repo.owner}/${repo.repo} has no public releases API (not found or private)`);
+        if (!res.ok)
+            throw new Error(`GitHub API HTTP ${res.status}`);
+        const batch = (await res.json());
+        if (!Array.isArray(batch))
+            throw new Error("GitHub API returned an unexpected releases payload");
+        out.push(...batch);
+        const reachedFrom = batch.some((r) => {
+            const v = typeof r.tag_name === "string" ? versionFromTag(r.tag_name, pkg, tagPrefix) : null;
+            return v !== null && stop(v);
+        });
+        if (batch.length < PER_PAGE || reachedFrom)
+            break;
+    }
+    return out;
+}
+/** `https://github.com/o/r/blob/<ref>/<path>` (or raw.githubusercontent.com) to a raw file URL, when it names a changelog file. */
+export function rawChangelogUrl(link) {
+    let m = /^https:\/\/github\.com\/([\w.-]+)\/([\w.-]+)\/(?:blob|raw)\/([^?#]+)$/i.exec(link.trim());
+    let rawUrl = m ? `https://raw.githubusercontent.com/${m[1]}/${m[2]}/${m[3]}` : null;
+    if (!rawUrl) {
+        m = /^https:\/\/raw\.githubusercontent\.com\/[\w.-]+\/[\w.-]+\/[^?#]+$/i.exec(link.trim());
+        rawUrl = m ? link.trim() : null;
+    }
+    if (!rawUrl)
+        return null;
+    const base = rawUrl.split("/").pop() ?? "";
+    return isChangelogName(base) ? rawUrl : null;
+}
+async function fetchChangelogFile(net, url) {
+    const res = await net.fetch(url, { headers: { "User-Agent": USER_AGENT } }, GITHUB_TIMEOUT_MS);
+    const limited = rateLimitMessage(res);
+    if (limited)
+        throw new GithubRateLimitError(limited);
+    if (!res.ok)
+        throw new Error(`HTTP ${res.status} for ${url}`);
+    const declared = Number(res.headers.get("content-length"));
+    if (Number.isFinite(declared) && declared > MAX_FILE_BYTES)
+        throw new ArchiveError(`${url} is over ${MAX_FILE_BYTES} bytes`);
+    const text = await res.text();
+    if (text.length > MAX_FILE_BYTES)
+        throw new ArchiveError(`${url} is over ${MAX_FILE_BYTES} bytes`);
+    return parseChangelog(text);
+}
+function inRangeCount(sections, from, to, order) {
+    return sections.filter((s) => (order(s.version, from) ?? 0) > 0 && (order(s.version, to) ?? 1) <= 0).length;
+}
+export function githubCacheKey(kind, where, input) {
+    return `upgrade-impact:github:p${CHANGELOG_PARSER_VERSION}:${kind}:${where}:${input.tagPrefix ?? ""}:${input.ecosystem}:${input.pkg}:${input.from}:${input.to}`;
+}
+/**
+ * The fallback: a GitHub changelog file the project links (PyPI), then the
+ * repository's releases. Caller checks the opt-in. Returns a not-found result
+ * with the reason (no GitHub repository, rate limit, no matching releases).
+ */
+export async function getGithubChangelog(net, input) {
+    const reasons = [];
+    for (const link of input.changelogLinks ?? []) {
+        const raw = rawChangelogUrl(link);
+        if (!raw)
+            continue;
+        const key = githubCacheKey("file", raw, input);
+        const hit = net.cache?.get(key);
+        if (hit)
+            return hit;
+        try {
+            const sections = await fetchChangelogFile(net, raw);
+            if (inRangeCount(sections, input.from, input.to, input.order) > 0) {
+                const result = { found: true, file: raw.split("/").pop(), sections, source: "github-file", url: link };
+                net.cache?.set(key, result, CACHE_SOURCE, FOUND_TTL);
+                return result;
+            }
+            reasons.push(`the changelog the project links (${link}) has no section for these releases`);
+        }
+        catch (err) {
+            if (err instanceof GithubRateLimitError)
+                return { found: false, reason: err.message };
+            reasons.push(`the changelog the project links could not be read: ${err.message}`);
+        }
+    }
+    const repo = parseGithubRepo(input.repository);
+    if (!repo) {
+        reasons.push("the package names no GitHub repository, so there are no GitHub releases to read");
+        return { found: false, reason: reasons.join("; ") };
+    }
+    const where = `${repo.owner}/${repo.repo}`;
+    const key = githubCacheKey("releases", where, input);
+    const hit = net.cache?.get(key);
+    if (hit)
+        return hit;
+    const releasesUrl = `https://github.com/${where}/releases`;
+    try {
+        const releases = await fetchReleases(net, repo, (v) => (input.order(v, input.from) ?? 1) <= 0, input.pkg, input.tagPrefix ?? null);
+        const sections = releasesToSections(releases, input.pkg, input.tagPrefix ?? null);
+        const hits = inRangeCount(sections, input.from, input.to, input.order);
+        const result = hits > 0
+            ? { found: true, file: "GitHub releases", sections, source: "github-releases", url: releasesUrl }
+            : {
+                found: false,
+                url: releasesUrl,
+                reason: [...reasons, `${where} has no GitHub release for ${input.pkg} between ${input.from} and ${input.to}`].join("; "),
+            };
+        const targetFound = sections.some((s) => input.order(s.version, input.to) === 0);
+        net.cache?.set(key, result, CACHE_SOURCE, targetFound ? FOUND_TTL : MISS_TTL);
+        return result;
+    }
+    catch (err) {
+        // A rate limit or network failure is not remembered: the next call may succeed.
+        return { found: false, url: releasesUrl, reason: [...reasons, `GitHub releases could not be read: ${err.message}`].join("; ") };
+    }
+}

package/dist/live/go-registry.d.ts

@@ -16,3 +16,8 @@ export declare class GoRegistry {
     constructor(cache: LiveCache, rateLimiter: RateLimiter);
     getPackageInfo(name: string, currentVersion: string | null, isDev: boolean): Promise<RegistryPackageInfo>;
 }
+/**
+ * Escape uppercase letters in Go module paths for the proxy URL.
+ * Go proxy convention: uppercase 'X' becomes '!x'.
+ */
+export declare function escapeModulePath(mod: string): string;

package/dist/live/go-registry.js

@@ -93,7 +93,7 @@ export class GoRegistry {
  * Escape uppercase letters in Go module paths for the proxy URL.
  * Go proxy convention: uppercase 'X' becomes '!x'.
  */
-function escapeModulePath(mod) {
+export function escapeModulePath(mod) {
     return mod.replace(/[A-Z]/g, (c) => "!" + c.toLowerCase());
 }
 /**

package/dist/live/go-releases.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Go module release index for dependency_check, from the module proxy
+ * (proxy.golang.org, the host `go get` downloads from):
+ *
+ * - `/@v/list`: the tagged versions, `+incompatible` ones included (a module
+ *   that predates modules and tags v2+ without a `/v2` path).
+ * - `/@v/<version>.info`: one release's time. The list carries no dates, so
+ *   this is read for the versions being judged only (cached; a published
+ *   version never changes). A pseudo-version (`v0.0.0-20240102150405-abcdef123456`)
+ *   is not in the list; its `.info` both confirms it exists and dates it.
+ * - The latest version's `go.mod`: its `retract` directives withdraw versions
+ *   (`go get` skips them), reported like a yank.
+ * - An untagged module: `@latest` gives its newest pseudo-version.
+ *
+ * Major versions 2+ are different module paths (`.../v5`); the proxy lists
+ * each path's own versions only.
+ *
+ * Not applicable to Go and reported so by the signals: publisher identity
+ * (integrity is checked against sum.golang.org instead), install hooks (Go
+ * runs no package code at download), per-release dependency lists.
+ */
+import type { LiveCache } from "./cache.js";
+import type { RateLimiter } from "./rate-limiter.js";
+import type { PackageReleaseIndex, RegistryLookup, ReleaseMetadataSource } from "./release-metadata.js";
+export declare const GO_NOT_APPLICABLE = "not applicable to Go modules: the proxy carries no publisher identity (downloads are checked against sum.golang.org)";
+/** A Go version: release, prerelease, pseudo-version, optional `+incompatible`. */
+export declare const GO_VERSION: RegExp;
+/** `v`-prefixed spelling of a Go version ("1.2.3" -> "v1.2.3"). */
+export declare function goVersion(raw: string): string;
+/** The commit time a pseudo-version embeds, as ISO, or null when `version` is not one. */
+export declare function pseudoVersionTime(version: string): string | null;
+export interface Retraction {
+    low: string;
+    high: string;
+    rationale: string | null;
+}
+/** `retract` directives of a go.mod: single versions, `[low, high]` intervals, and blocks of either. */
+export declare function parseRetractions(goMod: string): Retraction[];
+export declare class GoReleasesReader implements ReleaseMetadataSource {
+    private cache;
+    private rateLimiter;
+    constructor(cache: LiveCache, rateLimiter: RateLimiter);
+    getReleases(module: string, wanted: string[]): Promise<RegistryLookup<PackageReleaseIndex>>;
+    getCreatedAt(): Promise<RegistryLookup<string | null>>;
+    private list;
+    private info;
+    private get;
+}

package/dist/live/go-releases.js

@@ -0,0 +1,196 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Go module release index for dependency_check, from the module proxy
+ * (proxy.golang.org, the host `go get` downloads from):
+ *
+ * - `/@v/list`: the tagged versions, `+incompatible` ones included (a module
+ *   that predates modules and tags v2+ without a `/v2` path).
+ * - `/@v/<version>.info`: one release's time. The list carries no dates, so
+ *   this is read for the versions being judged only (cached; a published
+ *   version never changes). A pseudo-version (`v0.0.0-20240102150405-abcdef123456`)
+ *   is not in the list; its `.info` both confirms it exists and dates it.
+ * - The latest version's `go.mod`: its `retract` directives withdraw versions
+ *   (`go get` skips them), reported like a yank.
+ * - An untagged module: `@latest` gives its newest pseudo-version.
+ *
+ * Major versions 2+ are different module paths (`.../v5`); the proxy lists
+ * each path's own versions only.
+ *
+ * Not applicable to Go and reported so by the signals: publisher identity
+ * (integrity is checked against sum.golang.org instead), install hooks (Go
+ * runs no package code at download), per-release dependency lists.
+ */
+import { fetchWithTimeout } from "./http-utils.js";
+import { compareVersions } from "./version-compare.js";
+import { escapeGoPath } from "./upgrade-go.js";
+const GO_PROXY = "https://proxy.golang.org";
+const TIMEOUT_MS = 15_000;
+const LIST_TTL = 3600;
+const INFO_TTL = 30 * 86_400;
+/** `.info` reads per getReleases call. */
+const MAX_INFO_READS = 6;
+export const GO_NOT_APPLICABLE = "not applicable to Go modules: the proxy carries no publisher identity (downloads are checked against sum.golang.org)";
+/** A Go version: release, prerelease, pseudo-version, optional `+incompatible`. */
+export const GO_VERSION = /^v\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+incompatible)?$/;
+const PSEUDO = /(?:^v\d+\.\d+\.\d+-|[.-])(?:0\.)?(\d{14})-[0-9a-f]{12}(?:\+incompatible)?$/;
+/** `v`-prefixed spelling of a Go version ("1.2.3" -> "v1.2.3"). */
+export function goVersion(raw) {
+    const v = raw.trim();
+    return /^\d/.test(v) ? `v${v}` : v;
+}
+/** The commit time a pseudo-version embeds, as ISO, or null when `version` is not one. */
+export function pseudoVersionTime(version) {
+    const m = PSEUDO.exec(version);
+    if (!m)
+        return null;
+    const t = m[1];
+    return `${t.slice(0, 4)}-${t.slice(4, 6)}-${t.slice(6, 8)}T${t.slice(8, 10)}:${t.slice(10, 12)}:${t.slice(12, 14)}Z`;
+}
+/** `retract` directives of a go.mod: single versions, `[low, high]` intervals, and blocks of either. */
+export function parseRetractions(goMod) {
+    const out = [];
+    const entry = (text) => {
+        const [body, ...comment] = text.split("//");
+        const rationale = comment.join("//").trim() || null;
+        const interval = /^\s*\[\s*(v\S+?)\s*,\s*(v\S+?)\s*\]\s*$/.exec(body);
+        if (interval)
+            out.push({ low: interval[1], high: interval[2], rationale });
+        else {
+            const single = /^\s*(v\S+)\s*$/.exec(body);
+            if (single)
+                out.push({ low: single[1], high: single[1], rationale });
+        }
+    };
+    const lines = goMod.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+        const m = /^\s*retract\s+(.*)$/.exec(lines[i]);
+        if (!m)
+            continue;
+        if (m[1].trim().startsWith("(")) {
+            for (i++; i < lines.length && !/^\s*\)/.test(lines[i]); i++)
+                entry(lines[i]);
+        }
+        else {
+            entry(m[1]);
+        }
+    }
+    return out;
+}
+export class GoReleasesReader {
+    cache;
+    rateLimiter;
+    constructor(cache, rateLimiter) {
+        this.cache = cache;
+        this.rateLimiter = rateLimiter;
+    }
+    async getReleases(module, wanted) {
+        const list = await this.list(module);
+        if (list.status !== "ok")
+            return list;
+        const { versions, retractions } = list.data;
+        const releases = {};
+        for (const version of versions)
+            releases[version] = record(version, null, retractions);
+        // Dates (and existence, for a pseudo-version) of the versions being judged.
+        const want = [...new Set(wanted.map(goVersion))].filter((v) => GO_VERSION.test(v)).slice(0, MAX_INFO_READS);
+        await Promise.all(want.map(async (version) => {
+            const info = await this.info(module, version);
+            // The proxy answers `v20.10.0` with the `v20.10.0+incompatible` release: file it under its own name.
+            if (info === null || (info.Version && info.Version !== version))
+                return;
+            const time = info.Time ?? pseudoVersionTime(version);
+            releases[version] = { ...(releases[version] ?? record(version, null, retractions)), publishedAt: time ?? null };
+        }));
+        return { status: "ok", data: { ecosystem: "Go", name: module, createdAt: null, releases } };
+    }
+    async getCreatedAt() {
+        return { status: "ok", data: null };
+    }
+    async list(module) {
+        const key = `go-releases:${module}`;
+        const hit = this.cache.get(key);
+        if (hit)
+            return { status: "ok", data: hit };
+        const base = `${GO_PROXY}/${escapeGoPath(module)}`;
+        let versions;
+        try {
+            const res = await this.get(`${base}/@v/list`);
+            // The proxy answers 404 / 410 for a path it cannot resolve.
+            if (res.status === 404 || res.status === 410) {
+                return { status: "not_found", detail: `"${module}" is not a module the Go proxy can resolve` };
+            }
+            if (!res.ok)
+                return { status: "unreachable", detail: `Go module proxy answered HTTP ${res.status}` };
+            versions = (await res.text()).split("\n").map((v) => v.trim()).filter((v) => GO_VERSION.test(v));
+            if (versions.length === 0) {
+                // Untagged: the newest pseudo-version.
+                const latest = await this.get(`${base}/@latest`);
+                if (latest.ok) {
+                    const info = (await latest.json());
+                    if (info.Version && GO_VERSION.test(info.Version)) {
+                        versions = [info.Version];
+                        if (info.Time)
+                            this.cache.set(`go-info:${module}@${info.Version}`, info, "go", INFO_TTL);
+                    }
+                }
+            }
+        }
+        catch (err) {
+            return { status: "unreachable", detail: `Go module proxy: ${err instanceof Error ? err.message : String(err)}` };
+        }
+        // Retractions live in the newest version's go.mod.
+        let retractions = [];
+        let retractionsNote = null;
+        const newest = versions.reduce((max, v) => (max === null || compareVersions(v, max, "Go") > 0 ? v : max), null);
+        if (newest) {
+            try {
+                const res = await this.get(`${base}/@v/${escapeGoPath(newest)}.mod`);
+                if (res.ok)
+                    retractions = parseRetractions(await res.text());
+                else
+                    retractionsNote = `go.mod of ${newest}: HTTP ${res.status}`;
+            }
+            catch (err) {
+                retractionsNote = `go.mod of ${newest}: ${err instanceof Error ? err.message : String(err)}`;
+            }
+        }
+        const data = { versions, retractions, retractionsNote };
+        this.cache.set(key, data, "go", LIST_TTL);
+        return { status: "ok", data };
+    }
+    async info(module, version) {
+        const key = `go-info:${module}@${version}`;
+        const hit = this.cache.get(key);
+        if (hit)
+            return hit;
+        try {
+            const res = await this.get(`${GO_PROXY}/${escapeGoPath(module)}/@v/${escapeGoPath(version)}.info`);
+            if (!res.ok)
+                return null;
+            const info = (await res.json());
+            this.cache.set(key, info, "go", INFO_TTL);
+            return info;
+        }
+        catch {
+            return null;
+        }
+    }
+    async get(url) {
+        if (!this.rateLimiter.consume("go"))
+            throw new Error("Go module proxy rate limit reached for this minute");
+        return fetchWithTimeout(url, {}, TIMEOUT_MS);
+    }
+}
+function record(version, publishedAt, retractions) {
+    const hit = retractions.find((r) => compareVersions(version, r.low, "Go") >= 0 && compareVersions(version, r.high, "Go") <= 0);
+    return {
+        version,
+        publishedAt,
+        trust: 0,
+        trustEvidence: GO_NOT_APPLICABLE,
+        installScripts: null,
+        deprecated: hit?.rationale ? `retracted: ${hit.rationale}` : null,
+        withdrawn: hit ? "retracted" : null,
+        dependencies: null,
+    };
+}

package/dist/live/index.d.ts

@@ -7,9 +7,11 @@
  * Privacy: Only sends package names/versions (public) and tech keywords (generic).
  * Set FOURDA_OFFLINE=true to disable all network calls.
  */
-import type Database from "better-sqlite3";
-import type { ReleaseMetadataSource } from "./release-metadata.js";
+import type { SqliteDatabase } from "../sqlite-driver.js";
+import { FixPathSources } from "./fix-paths.js";
+import type { CheckEcosystem, ReleaseMetadataSource } from "./release-metadata.js";
 import { type ResolutionGroup } from "./resolution.js";
+import type { TreeDiscovery } from "../project-tree.js";
 import type { InstallDriftRecord, ResolutionProvenance, ResolvedDependency, RegistryPackageInfo, VulnerabilityScanResult, LiveHeadline, LiveIntelligenceStatus } from "./types.js";
 export type { VulnerabilityScanResult, VulnerabilityEntry, LiveHeadline, LiveIntelligenceStatus, RegistryPackageInfo, DependencyHealthResult, InstallDriftRecord, ResolutionProvenance, } from "./types.js";
 export declare class LiveIntelligence {
@@ -24,6 +26,9 @@ export declare class LiveIntelligence {
     private goRegistry;
     private npmPackuments;
     private cratesVersions;
+    private pypiReleases;
+    private goReleases;
+    private fixPathSources;
     private enabled;
     private lastVulnScan;
     /** Whether the stored scan included direct devDependencies. */
@@ -37,6 +42,8 @@ export declare class LiveIntelligence {
      * runs, 2026-10-03 pre-publish verification).
      */
     private scanRequests;
+    /** Scans running now, by generation, scope and path: a request for one of them awaits it. */
+    private scansInFlight;
     private storedScanRequest;
     private lastHeadlines;
     private resolvedDeps;
@@ -45,6 +52,8 @@ export declare class LiveIntelligence {
     private projectRoot;
     /** One entry per resolution group: its inputs, result, and the file signatures that say when it went stale. */
     private groupResults;
+    /** The project-tree walk's report of what it left out, when the groups came from one. */
+    private discovery;
     /** When the dependency set in use was assembled: at init, or at the last re-resolution. */
     private resolvedAt;
     /**
@@ -61,7 +70,15 @@ export declare class LiveIntelligence {
     private warmup;
     /** When the last warmup came back offline; gates the retry so an offline host is not re-probed on every call. */
     private warmupFailedAt;
-    constructor(db: Database.Database);
+    constructor(db: SqliteDatabase | null);
+    /** Advisory, registry and parent-requirement lookups for fix paths; null when offline. */
+    getFixPathSources(): FixPathSources | null;
+    /**
+     * The lockfile one manifest directory resolved this ecosystem from, or null
+     * when it resolved from a manifest or nothing. `dir` is spelled as the
+     * resolution group spells it (the scan's sourceDirs).
+     */
+    lockfileFor(dir: string, ecosystem: string): string | null;
     /**
      * Initialize with project data. Call once after project scan.
      * @deprecated Use initFromMultiEcosystem for correct per-ecosystem resolution.
@@ -81,7 +98,18 @@ export declare class LiveIntelligence {
      * project-tree.ts): each group resolves from its own directory and keeps
      * its manifest's platform targets; `root` is the reported project root.
      */
-    initFromProjectTree(root: string, groups: ResolutionGroup[]): void;
+    initFromProjectTree(root: string, groups: ResolutionGroup[], discovery?: TreeDiscovery | null): void;
+    /**
+     * Manifests with no lockfile beside them, whose ranged dependencies were not
+     * scanned: their versions are declared ranges, not installs.
+     */
+    getUnresolvedManifests(): Array<{
+        dir: string;
+        manifest: string;
+        ranges: number;
+    }>;
+    /** What the project-tree walk left out (lockfiles past its bounds); null when the set did not come from a walk. */
+    getDiscovery(): TreeDiscovery | null;
     /**
      * Initialize from dependency groups that each carry their own resolution
      * directory. Used in 4DA database mode, where dependencies span multiple
@@ -133,6 +161,7 @@ export declare class LiveIntelligence {
         includeDev?: boolean;
         forceRefresh?: boolean;
     }): Promise<VulnerabilityScanResult>;
+    private runScan;
     /**
      * Start the vulnerability scan in the background without blocking startup.
      * Never rejects: a failed scan resolves to an empty OFFLINE result so the
@@ -183,10 +212,7 @@ export declare class LiveIntelligence {
     isInitialized(): boolean;
     fetchRegistryHealth(deps: ResolvedDependency[]): Promise<RegistryPackageInfo[]>;
     /** Per-release registry readers for dependency_check (name-only requests). */
-    getReleaseSources(): {
-        npm: ReleaseMetadataSource;
-        "crates.io": ReleaseMetadataSource;
-    };
+    getReleaseSources(): Record<CheckEcosystem, ReleaseMetadataSource>;
     /**
      * OSV advisories for explicit (ecosystem, name, version) triples that need
      * not be in the project, e.g. a version an agent is about to install. Same